Gateway cheats seem like magic. How can a seemingly random string of numbers give us infinite lives in Super Mario 3D Land or make us invincible? It's simple. They access our machines RAM that holds our game information and manipulate bytes to do what we want. They can be viewed as a very rudimentary form of programming language, but one that is mighty powerful.

In this "quick" guide I am going to explain the different code types that are implemented in the Gateway cheat engine, what the codes do and how we construct them. In order to understand the codes and prevent any misunderstandings we need to define the terminology first, so here's a list of words that I will be using throughout the tutorial. I will also be giving alternative terminology that might be used in other areas of computing, but for the sake of this tutorial we are going to stick with the terminology that is marked in bold.

Note beforehand: We are going to be dealing a lot with hexadecimal numbers when creating codes (base 16). Since we mainly use the decimal system in our daily lives we will have to calculate between decimal and hexadecimal (or vice versa) quite often. Whenever I am using a hexadecimal number, it will be denoted by a leading '0x'. This will help us to not confuse hexadecimal values that look like decimal values (like 0x10 for example) with their decimal sibbling (10). So when you see a regular number like '10', that will be decimal. If it's 0x10, it's hexadecimal (0x10 = 16, fyi). 0b will be used for denoting binary numbers (only used in the 16-bit conditional codes).


Code: A code consists of various parameters. Parameters are 'code type', 'address', 'value', 'offset' 'mask' and 'data register'. A code is split into two 8-digit strings separated by a space.

Code Type: Determines what the code does. The first digit of a code determines the code type, note that some code types (like the D codes) can be further split into secondary code types, which will be determined by the second digit of the code. Gateway supports 28 different code types, 27 of which gateway has documented.

Address: the games memory is laid out in bytes, each byte represented by an individual address and performing a specific task within the games memory. We can precisely define which byte we want to manipulate by telling the Gateway cheat engine the exact address of the byte. I common computer terminology an address is often called 'offset', but we are going to need that term for something else so we will be calling addresses strictly by the name 'address'.

Value: This is the value of a specific byte in the games memory. For example the address that holds your ammount of lives in Super Mario 3D Land has a value corresponding to this number. Often called 'data'. To avoid confusion with the 'data register' only the term 'value' will be used.

Offset: Since the first digit of a code line is always reserved we might – depending on the code type – not be able to enter an 8-digit address into a code. If the address we want is more than 7 digits, we need to set the offset to a value that, when added to the address paramter, adds up to our correct 8-digit address we want to manipulate.

Mask: Only used in 16-bit conditional instructions. It allows us to 'mask' individual bits in the condition – comparable to wildcards. This will be clearly explained at the 16-bit conditional section.

Data register: a specific register that can hold a value and add to that value. By default it is 0x0 but we can set it to any value we want or load a value from any address. Specific code types are used for loading a value from an address or writing the value within the data register to an address.


So without further ado, here are the code types:

Memory Writes:
parameters: address (XXXXXXX), value (YY, YYYY, YYYYYYYY)
To write an address higher than 0xFFFFFFF, you need to set an offset using code Type 0xD3. The offset gets added to the address parameter to determine the final address we want to manipulate. See Code type 0xD3 for further instructions.

The memory write codes are split into three code types. Which code type is used depends on the value you want to write. One byte can hold 256 values, two bytes can hold 256² values, four bytes can hold 256^4 values, including 0. So the maximum value a write instruction can write is:

8-bit : 255
16-bit: 65.535
32-bit: 4.294.967.295
If the game stores a value as 8-bit, doing a 16-bit or 32-bit write to the address might break the game or manipulate other values of the game that we might not intent to change. As an example, „Legend of Zelda: Tri Force Heroes“ stores the ammount of the items we have in 70 consecutive bytes, so doing a 16-bit write to such an address will also modify the item next to the one we wanted to change. So be carefull to only manipulate as little as neccessary, but as much as required.

0XXXXXXX YYYYYYYY – 32bit write to [XXXXXXX + offset]
writes the 32-bit value we specify to the given address. This manipulates four bytes starting at the given address. Two 16-bit writes can be used with the same result, endianness has to be taken into account. See Note at the end of the tutorial about endianness.

1XXXXXXX 0000YYYY – 16bit write to [XXXXXXX + offset]
writes the 16-bit value we specify to the given address. This manipulates two bytes starting at the given address. Two 16-bit writes can replace a 32-bit write, however endianness has to be taken into account. See Note at the end of the tutorial about endianness.

2XXXXXXX 000000YY – 8bit write to [XXXXXXX + offset]
writes the 8-bit value we specify to the given address. This manipulates a single byte. Two 8-bit writes can replace a 16-bit write, however endianness has to be taken into account. See Note at the end of the tutorial about endianness.

Examples:

Spoiler

03BA110C 01CD5F99 – writes the value 0x1CD5F99 (30.236.569) to the address 0x3BA110C. Manipulates the bytes at addresses 0x3BA110C, 0x3BA110D, 0x3BA110E and 0x3BA110F.

13BA110C 00005F99 – writes the value 0x5F99 (24.473) to the address 0x3BA110C. Manipulates the bytes at addresses 0x3BA110C and 0x3BA110D.

23BA110C 00000099 – writes the value 0x99 (153) to the address 0x3BA110C. Manipulates only the byte at addresses 0x3BA110C.

Conditional 32bit codes:
parameters: address (XXXXXXX), value (YYYYYYYY)

Conditional codes allow us to compare the value of an address to the value we provide as a parameter. If the condition is true execution continues at the next code line. If false, execution will jump to the next terminator code (Code type 0xD0 and 0xD2) and continue from there. Conditionals can be nested. The code does not manipulate the games memory on it's own, it needs to be followed by a code that does the manipulation (a 32-bit write for example).


3XXXXXXX YYYYYYYY – Less Than (YYYYYYYY < [XXXXXXX + offset])
If the value at the specified address is less than the value we provide, continue the instruction.

4XXXXXXX YYYYYYYY – Greater Than (YYYYYYYY > [XXXXXXX + offset])
If the value at the specified address is greater than the value we provide, continue the instruction.

5XXXXXXX YYYYYYYY – Equal To (YYYYYYYY == [XXXXXXX + offset])
If the value at the specified address is equal to the value we provide, continue the instruction.

6XXXXXXX YYYYYYYY – Not Equal To (YYYYYYYY != [XXXXXXX + offset])
If the value at the specified address is not euqal to the value we provide, continue the instruction.

Examples:

Spoiler

33BA110C 00000063 – if the value at address 0x3BA110C is less than 0x63 (99), execute next line.
03BA110C 01CD5F99 – sets the value at address 0x03BA110C to 30.236.569
D0000000 00000000 – ends the if instruction and continue code exection without the conditional.

63BA110C 00000063 – if the value at address 0x3BA110C is anything other than 0x63 (99), execute next line.
03BA110C 01CD5F99 – sets the value at address 0x03BA110C to 30.236.569
D0000000 00000000 – ends the if instruction and continue code exection without the conditional.

Conditional 16bit deref + write codes:
parameters: address (XXXXXXX), value (YYYY), mask (ZZZZ)
Even though Gateway calls them write codes, according to the Datel trainer toolkit manual for the AR DS and my trials these do not write to the location. It needs to be followed by a code that does the manipulation (a 16-bit write for example). The mask parameter allows us to mask out specific bits of the 16 bit value for the condition. If the mask is set to 0x0000 the code will behave exactly like the conditional 32-bit codes (Code types 0x03-0x06).

7XXXXXXX ZZZZYYYY – Less Than
If the masked value at the specified address is less than the masked value we provide, continue the instruction.

8XXXXXXX ZZZZYYYY – Greater Than
If the masked value at the specified address is greater than the masked value we provide, continue the instruction.

9XXXXXXX ZZZZYYYY – Equal To
If the masked value at the specified address is equal to the masked value we provide, continue the instruction.

AXXXXXXX ZZZZYYYY – Not Equal To
If the masked value at the specified address is not equal to the masked value we provide, continue the instruction.

Understanding masks is a bit tricky and from the top of my head I can't really think of a reasonable practical use of a masked conditional but i'll try my best to explain them. If you think you can provide a clearer explanation of masks, feel free to post it, I can insert it here if you like.

Masks work on a binary/bit level. A mask of 0x0000 will translate to 0b00000000 00000000 (space added for better readability), 0xFFFF will translate to 0b11111111 11111111. Any bit set to 1 will be ignored when comparing the value at the address provided with the value we pass in the code.

Let's say when our character does a regular jump the value at address 0x03BA110C changes to 0x25 but when we do a running jump it changes to 0x15. Address 0x03BA110E determines the gravity and we want to set it to zero every time we jump, regardless if we made a regular jump or a running jump. A code 93BA110C 00000005 (mask = 0x0000) would only be true for a regular jump, not a running jump. Thats why we want to mask out any bits that we consider irrelevant for our condition. To do that we have to translate 0x25 and 0x15 to binary first:

0b00000000 00100101 = 0x25
0b00000000 00010101 = 0x15

we want the condition to be true whenever the value ends with 0x5 so we translate that to binary:

0b00000000 00000101 = 0x5

we mask out all the bits that we do not care about with a 0b1 and convert it to hexadecimal

0b11111111 11111000 = 0xFFF8

This mask will only take the last 3 bits of the value and compare it to the last three bytes of our value that we pass in the code. So in our example, whenever the last three binary digits of our value matches 0b101 (0x5) the condition holds true and we continue to the next code line. If it is false we jump to the next 0xD0 or 0xD2 code.

Examples:

Spoiler

93BA110C 00000005 – if the value at address 0x03BA110C is exactly 0x5 execute next line. True only for 0x5
13BA110E 00000001 – sets the value at address 0x03BA110E to 1
D0000000 00000000 - ends the if instruction and continue code exection without the conditional.


93BA110C FFF80005 – if the masked value at address 0x03BA110C is 0x5 execute next line. True for 0x5, 0x15, 0x25 etc. (but also 0xD, 0x1D, 0x2D etc.)
13BA110E 00000001 – sets the value at address 0x03BA110E to 1
D0000000 00000000 - ends the if instruction and continue code exection without the conditional.

Offset Codes:

Since for a lot of codes only a 7-digit address can be parsed we often need to add an offset to that address parameter to determine the final address. We have a few types of codes dealing with offsets. The rule is always: address parameter + offset = destination address.

D3000000 XXXXXXXX – set offset to immediate value
parameters: offset (XXXXXXXX)

This will set the offset to an immediate value we pass in the code. This value gets added to any address parameter in all other code types to result in the destination address so in order to write to addresses with 8-digits it is necessary to set an offset. It is also quite common to set the offset to the destination address and work with the address parameter 0x0000000 in all other codes. This method, in my opinion, has a few advantages so in my codes you will usually see me declaring an offset everytime, even if it would not be necessary.

Examples:

Spoiler

D3000000 10000000 – sets the offset to 0x10000000
23BA110E 00000063 – writes a 8-bit value of 0x63 (99) to the address at 0x13BA110E (0x10000000 + 0x3BA110E = 0x13BA110E)

The same code can also be written like this:

D3000000 13BA110E – sets the offset to 0x13BA110E
20000000 00000063 – writes a 8-bit value of 0x63 (99) to the address at 0x13BA110E (0x13BA110E + 0x00000000 = 0x13BA110E)

As you can see, this allows you to see the address more clearly than the first method. Which method you prefer is up to you, both methods are correct and valid.

DC000000 XXXXXXXX – Adds an value to the current offset
parameters: value (XXXXXXXX)

This code type allows you to increase the offset by the hexadecimal value you provide. This is particularly useful in combination with the loop code (see code type 0xC0) to manipulate a lot of addresses laid out in a repeating pattern with only a few lines of code.

Examples:

Spoiler

D3000000 13BA110C – sets the offset to 0x13BA110C
20000000 00000063 – writes an 8-bit value of 0x63 (99) to the address at 0x13BA110C (0x13BA110C + 0x00000000 = 0x13BA110C)
DC000000 00000002 – increases the offset by 0x2, Offset is now 0x13BA110E
20000000 00000063 – writes an 8-bit value of 0x63 (99) to the address at 0x13BA110E (0x13BA110E + 0x00000000 = 0x13BA110E)

BXXXXXXX 00000000 – offset = *(xxx)
parameters: address (XXXXXXX)

This code type allows us to load a 32-bit value from the address we provide (+ any offset we might have set before) into the offset register, replacing the current offset. This allows us to use pointers in our code. For a tutorial on how to find pointers, see http://www.maxconsole.com/maxcon_forums/threads/293146-Finding-Pointer-Codes-With-Gateway-RAM-Dump (thanks to @json,for pointing towards that tutorial)

Example:

Spoiler

D3000000 13BA110C – sets the offset to 0x13BA110C
B0000000 00000000[COLOR=][/COLOR] – loads the 32-bit value at address 0x13BA110C into the offset register, replacing our current offset. So if the value at 0x13BA110C is 0x368F39C3, this will be our new offset (Note: when viewing hex values in a hex editor on your pc or the gateway cheat menu, take endianness into account!)
20000000 00000063 – writes an 8-bit value of 0x63 (99) to the address at 0x368F39C3 (0x368F39C3 + 0x00000000 = 0x368F39C3)

Loop Code:
C0000000 YYYYYYYY – Sets the repeat value to ‘YYYYYYYY’

parameters: number of loops (YYYYYYYY)

This code allows us to repeat the following block of codes as often as we need it to. When code type 0xD1 or 0xD2 is hit, the loop number will decrease by 0x1 and start again. Combined with other codes we can manipulate a huge array of addresses with just a few lines of code.

Example:

Spoiler

D3000000 13BA110C – sets the offset to 0x13BA110C
C0000000 00000032 – repeat the following instructions 0x32 (50) times
20000000 00000063 – writes an 8-bit value of 0x63 (99) to the address at 0x13BA110C (0x13BA110C + 0x00000000 = 0x13BA110C)
DC000000 00000002 – increases the offset by 0x2, Offset is now 0x13BA110E
D1000000 00000000 – decrease loop counter by 0x1, jump back to the previous 0xC0 code.

So instead of manipulating 50 addresses one by one, our loop does automatically set the value of every other address to 0x63 (99)

Terminator Codes
D0000000 00000000 – End If instruction
This code ends the current conditional cod instruction. For examples see the section about conditional codes

D1000000 00000000 – End repeat instruction
This code decreases the current loop counter by one and returns code execution to the last 0xC0 code. See Loop code for examples.

D2000000 00000000 – end code instruction. (not documented by team gateway)

This code decreases the current loop counter by one and returns code execution to the last 0xC0 code. It also ends any conditional blocks. It also clears the current offset and any value you might have written to the data register. It is recommended to use this as final code terminator before starting a new code.


Data Register Codes:
The data register allows us copy a value from an address and manipulate it before writing it back to an address (either the same address or any other one). The data register is always 32-bit, we can decide on the “bit-ness” during the write instructions. If not set or loaded by any code, it will be 0x0.

D5000000 XXXXXXXX – Sets the data register to XXXXXXXX
parameters: value (XXXXXXXX)

This code allows us to set the content of the data register to any arbitrary value we want.


D9000000 XXXXXXXX – (32bit) sets data to [XXXXXXXX+offset]
parameter: address (XXXXXXXX)

This will load the 32-bit value from the address provided (also taking the offset into account) and store it in the data register.


DA000000 XXXXXXXX – (16bit) sets data to [XXXXXXXX+offset] & 0xffff
parameter: address (XXXXXXXX)

This will load the 16-bit value from the address provided (also taking the offset into account) and store it in the data register.


DB000000 XXXXXXXX – (8bit) sets data to [XXXXXXXX+offset] & 0xff
parameter: address (XXXXXXXX)

This will load the 8-bit value from the address provided (also taking the offset into account) and store it in the data register.


D4000000 XXXXXXXX – Adds XXXXXXXX to the data register
parameters: value (XXXXXXXX)

This code simply adds the value we pass to the data register.


D6000000 XXXXXXXX – (32bit) [XXXXXXXX+offset] = data ; offset += 4
parameters: address (XXXXXXXX)

This code writes the current content of the data register to the address provided (taking the offset into account) as a 32-bit value. After the write it automatically increases the current offset by 0x4.


D7000000 XXXXXXXX – (16bit) [XXXXXXXX+offset] = data & 0xffff ; offset += 2
parameters: address (XXXXXXXX)

This code writes the current content of the data register to the address provided (taking the offset into account) as a 16-bit value. After the write it automatically increases the current offset by 0x2.


D8000000 XXXXXXXX – (8bit) [XXXXXXXX+offset] = data & 0xff ; offset++
parameters: address (XXXXXXXX)

This code writes the current content of the data register to the address provided (taking the offset into account) as a 8-bit value. After the write it automatically increases the current offset by 0x1.

Example for data register usage:

Spoiler

D3000000 13BA110C – sets the current offset to 0x13BA110C
D5000000 413C0000 – sets the data register to 0x413C0000
C0000000 0000002B – start a loop and execute it 0x2B (43) times
D6000000 00000000 – Write the data register to address 0x13BA110C and increase the offset by 0x4. New offset is now 0x13BA1110. Data register remains 0x413C0000
D1000000 00000000 – decreases the loop count by 0x1 and returns to the 0xC0 line above. When the loop count is at 0x0, execution continues at the next code line.
D3000000 13BA178C – sets the current offset to 0x13BA178C
C0000000 0000002B - start a loop and execute it 0x2B (43) times
D6000000 00000000 – write the data register to address 0x13BA178C and increases the offset by 0x4. New offset is now 0x13BA1790. Data register remains 0x413C0000
D2000000 00000000 – decreases the loop counter by 0x1, returns to the previous 0xC0 code. As soon as loop counter is 0x0, it clears the data and offset register, both return to 0x0,

Special Codes:

DD000000 XXXXXXXX – if KEYPAD has value XXXXXXXX execute next block
parameters: keypad value

This code allows us to activate codes only as soon as a button combo is pressed. This is great for creating codes that can be enabled “on demand” by pressing the button combo that corresponds with the value we pass. Each button corresponds to a specific hexadecimal value. We just add any values of the buttons we want to be pressed for the button to activate. Let’s assume we want to press L+R+Start+Select, we just add 0x200, 0x300, 0x8 and 0x4. The result is 0x50C

So by putting the line DD000000 0000050C in front of our code we will have to press the buttons to activate the code. The gateway cheat engine seems to be very sensitive about the button presses so sometimes the code will execute multiple times with even the shortest of a press of the button combo. See the following list for the available keys and their corresponding values. New 3DS exclusive buttons (ZL, ZR, C-Stick) are currently not available.

Spoiler

0x1 A
0x2 B
0x4 Select
0x8 Start
0x10 Right
0x20 Left
0x40 Up
0x80 Down
0x100 R
0x200 L
0x400 X
0x800 Y

EXXXXXXX YYYYYYYY - Patch Code
Parameters: address (XXXXXXX), Number of Bytes (YYYYYYYY)

This code type was introduced in gateway 3.6.2, but the implementation is a bit iffy. I believe Gateway may have botched this one up slightly. This code writes YYYYYYYY bytes from the list of following values (an example will make this a bit clearer, please bear with me) starting at the address (+offset we might have set). Where this code gets a bit iffy is the endianness it treats the list of values to write:

Spoiler

D3000000 32C825A4 - sets the current offset to 0x32C825A4
E0000000 00000008 - write the following list of 08 (0x10) bytes to the addresses 0x32C825A4 onwards
44332211 88776655 - this is the part the code goes iffy. 0x11 is the value that gets written to 0x32C825A4, 0x22 gets written to 0x32C825A5, 0x55 to 0x32C825A8, 0x66 to 0x32C825A9 etc.

Logic would usually dictate that it should not treat the list as individual 32-bit strings but simply a stream of bytes to write, but it does. So this code is to be used very carefully as to write the proper value to the addresses we want. It's not broken per se, it's just a bit tricky to bend your mind around the stream of bytes.

The 0xE code type will also disable code type detection for YY of bytes in the code list. I.e. in the above example the line following E0000000 00000008 would simply be interpreted as a list of values, not an 0x4 (32-bit 'greater than' conditional) code type.

Footnote about endianness:

If you looked at a RAM dump of the 3DS - either in the built in hex editor or your PC - you might have noticed that when looking at a value at an address the values our codes write do not seem to match up. Thi is because the 3DS RAM is laid out in little endian, our codes are written in big endian. When we take the 32-bit big endian value 11223344 the cheat engine will split these up into four bytes, 11 22 33 44 then start by writing the least significant byte (44) to the address we want. then writes the next byte (33) to the following address. For further clarifcation, check the Wikipedia entry about endianness. For the sake of this guid:

When you pass the value 1A2B3C4D in a code, it'll show up as 4D 3C 2B 1A in RAM. The value will be correct, though.

Changelog:

Spoiler

19.01.2016: fixed code types 0x3, 0x4, 0x7 and 0x8. Thanks @dsrules
26.01.2016: added code type 0xE - patch code.

 

[FF777]

[Infinite Hearts]
D3000000 32CA6404 (set the offset to address 32CA6404)
DB000000 00000001 (set the (8-bit) data-register to the value stored in address 0x1+offset)
D8000000 00000000 (write an 8-bit value from the data-register (it writes it to 32CA6404))
D2000000 00000000 (end code, reset offset to zero et cetera)

Oh, that's clever.. I like smart people..

On a side note, I have never made a guide on here before (and I don't even really post very often), but I was thinking about making a guide of how to do cheat code math (and maybe other ways of solving cheat code problems).. I was thinking maybe you could link to it if you want to (if I ever get off of my lazy bum and make it).. We obviously know how to do addition and subtraction already, and I am fairly sure I can do multiplication (but still need to make some test code to make sure), and I think if I can figure out how to do division also then I will probably be ready to make the guide, and probably will keep adding some stuff to it every once in a while if I need to.. I will try to figure that stuff out and do some tests in the next few days..

 

[Localhorst86]

Oh, that's clever.. I like smart people..

On a side note, I have never made a guide on here before (and I don't even really post very often), but I was thinking about making a guide of how to do cheat code math (and maybe other ways of solving cheat code problems).. I was thinking maybe you could link to it if you want to (if I ever get off of my lazy bum and make it).. We obviously know how to do addition and subtraction already, and I am fairly sure I can do multiplication (but still need to make some test code to make sure), and I think if I can figure out how to do division also then I will probably be ready to make the guide, and probably will keep adding some stuff to it every once in a while if I need to.. I will try to figure that stuff out and do some tests in the next few days..

Multiplication should be easily implemented with a loop, right now my brain doesn't want to think about whether dividing would work, too, though [emoji3]

Sure, if you create a guide that relates to gateway cheats, I'll link it gladly in the original post.

 

[FF777]

Okay so as far as I can tell, any meaningful way to multiply or divide is impossible with the cheat system's very limited functions..
This whole time I was thinking that the "D4000000 XXXXXXXX" instruction looked up the address at XXXXXXXX and added its value to the current data-register value..
If that is the way that it worked, we could have multiplication and division and all sorts of higher-level functions..
But unfortunately what that instruction actually does is just take XXXXXXXX as a value (not as an address) and just plainly adds that arbitrary number to the current data-register..

What this means is that, although you can set/copy a value from an address using DB/DA/D9 instructions, after you copy that value to the data-register, you can only do 2 very basic functions after that:
1: You can copy the data-register value to an address some where (D8/D7/D6)
2: You can add an arbitrary value to the data-register (D5)..

This means that if you use the D5 instruction, it is kind of "hard-coded" and can't dynamicly change based on any varying value in the game..
So yeah, you can make a loop like this:
C0000000 00000003 (Start loop 3 times)
D4000000 00000004 (Add 4 to the data-register)
D1000000 00000000 (End of loop)
D3000000 32CA56F8 (Set offset)
D8000000 00000000 (Write the data-register to 32CA56F8)

That will multiply 4 x 3, which will set your rupees to 12, so yes we can technically multiply....but we can only multiply hard-coded numbers that we typed in.. Both the value of 4 and the 3 loops are hard-coded in to our codes and never change..
This makes the fact that we can do multiplication completely pointless.. Because if the values are going to be hard-coded any way, we might as well just skip multiplication and just hard-code the value of 12 in to the codes..

So this means that things like copying one value to an other is possible; like we can make a code that makes your rupees always reflect how many hearts you have, so if you have 4 hearts then you will also have 4 rupees; if you get a 5th heart, then your rupees automatically go up to 5 also..

But things like multiplying a varying value and writing it to an address are (as far as I can tell) impossible.. Like even doing some thing simple like making your rupees twice as much as your hearts, so that if you have 5 hearts then you automatically have 10 rupees.. This is impossible to do with the limited functionality of this cheat system..

I have even tried to figure out some weird convoluted way to do it, even if it used a ridiculous amount of code lines or nested loops.. But as far as I can tell, it is literally impossible..

Like I said in the first paragraph, if we just had a simple code instruction that could look at a certain address's value and then add it to the current data-register, magic could happen and we could do much more.. But until then, unless some one else can point out some thing that I missed, I think we will have to live with very basic cheat functionality..

EDIT: The ONLY way to possibly emulate such a thing would involve an ungodly number of conditional statements, like "if hearts = 1 then rupees = 2" and "if hearts = 2 then rupees = 4".. Basically hard-coding every possible value pair that you might need in to the cheat code.. This would obviously make your cheat-code really huge really quickly so you would never want to use it in most cases..
But if some one desperately needs one value multiplied (or divided etc) by an other value, and the range of possible numbers is small (maybe the game only let's you have 9 hearts total or some thing) then some one could make a code for them selves to solve their problem I guess.. But it isn't true multiplication, it is just a ridiculously crude work-around until there is some thing better..

 

[urherenow]

[Infinite Hearts]
D3000000 32CA6404 (set the offset Tod address 32CA6404)
DB000000 00000001 (set the (8-bit) data-register to the value stored in address 0x1+offset)
D8000000 00000000 (write an 8-bit value from the data-register (it writes it to 32CA6404))
D2000000 00000000 (end code, reset offset to zero et cetera)

I'm very interested in knowing how you found this code. I haven't tried your code yet, but I spent a good bit of time making my own Infinite heart code and it is much larger:

D3000000 32000000
00C824F4 01002424
00D8D9E0 42FC0000
00D8DB34 41100000
00D8F854 00000009
00D8F92C 41100000
00D8F944 41100000
00D8F990 41100000
00D8FBB4 00000009

This is on a 10.5 emunand, USA N3DS, running TFH 1.3.0. It's weird that I had to use all of these addresses (and none of them match yours), and it still isn't quite right. You know how the last heart (on the far right) you have is supposed to sort of pulsate? Once I am hit, the second one pulsates even though all are filled. Also this code freezes the game if you forget to turn it off before you grab whatever is in a large chest and exit the stage back to the castle...

 

[Localhorst86]

I'm very interested in knowing how you found this code. I haven't tried your code yet, but I spent a good bit of time making my own Infinite heart code and it is much larger:

D3000000 32000000
00C824F4 01002424
00D8D9E0 42FC0000
00D8DB34 41100000
00D8F854 00000009
00D8F92C 41100000
00D8F944 41100000
00D8F990 41100000
00D8FBB4 00000009

This is on a 10.5 emunand, USA N3DS, running TFH 1.3.0. It's weird that I had to use all of these addresses (and none of them match yours), and it still isn't quite right. You know how the last heart (on the far right) you have is supposed to sort of pulsate? Once I am hit, the second one pulsates even though all are filled. Also this code freezes the game if you forget to turn it off before you grab whatever is in a large chest and exit the stage back to the castle...

You'd have to ask FF777, its his code. I only changed his existing code slightly to show him how he could make his code more "stable"

From what youre describing, though, it seems you're only modifying the addresses that are responsible for displaying the hearts, not the hearts themselves.

 

[Deleted User]

Can you make a list of types of codes you would want added? We can mail it to gateway and see if they can add it

 

[FF777]

Can you make a list of types of codes you would want added? We can mail it to gateway and see if they can add it

I emailed them the other day (their "sales" email since that is the only one I could find) telling them that they should add that "I forgot" option to the cheat menu..

I have no idea what types of cheat codes they should add, but off the top of my head:

1: They definitely need one that reads from an address and adds it to the data-register (and also one that reads from an address and subtracts the value)..
Kind of like: ZZ000000 XXXXXXXX where ZZ is the code-type and XXXXXXXX is the address(+offset) it reads from..
I believe adding these two code-types alone (address addition and subtraction) would really enable lots of higher-level functions like multiplication and division and stuff.. Like I said in a previous post, with the very limited code types we have now, you can't do any thing like [Make Luigi's lives twice the amount of Mario's] or like [Your HP is always half of the maximum].. You just can't do those things with our current cheat system..
Here is an other neat code you could do with like if you were playing some RPG with 4 people like a final-fantasyish game; Maybe you don't want to use the plain old "Infinite HP for Every one" code because that makes the game way too easy and boring and feels like you are cheating too much.. So instead you create a code that doesn't necessarily give you any more HP, but allows you to redistribute all of the party-members' HP evenly among them selves when you push an activator button; Here is some pseudo-code:
[L+R+D-Up to Share HP]
> Detect if L+R+D-Up is being pressed; if so then:
> Set data-register/DR to 0
> Add 1st player's HP to DR
> Add 2nd player's HP to DR
> Add 3rd player's HP to DR
> Add 4th player's HP to DR
> Divide DR by 4
> Set each of the 4 players' HP to the value in DR
> Profit
(See how great communism can be?)

2: It would be nice to have a 2nd data-register so that you can hold more than merely a single value in memory.. Although it is probably not absolutely necessary because you can actually do quite a bit just with 1 data-register (as long as you have good code-types for manipulating it!)..

3: Gateway needs to get around to adding the new-3ds-exclusive buttons to the possible button-activator values, because:
> Lots of people have new-3DSs and this trend will only increase as time goes on..
> It seems incomplete to not have them..
> If some one with an old-3DS wants to use codes that use new-3ds-exclusive buttons, all they have to do is change the activator value to whatever they want..
> new-3DS users should not have to suffer just for the sake of old-3DS users..

4: Add a damn code-type that subtracts.. It isn't that difficult.. And if some one subtracts from 0x00000000 then just make it loop back to 0xFFFFFFFF.. Simple as that.. It is the same way the addition operation works; If you add 1 to 0xFFFFFFFF it loops back to 0x00000000 (right?).. As it stands now, we have to use some convoluted method to subtract a number.. We don't necessarily need a multiplication or division code-type because you can build both of those functions on top of the addition and subtraction operations.. But it would be nice to have them for convenience and for code efficiency (makes the codes shorter)..

So, that is all I can think of off the top of my head.. I wish I could be in charge of the cheat-code team so I could whip them and command them of what to do.. I would have a very robust cheat-system implemented.. If nothing else, have some other CFW like NTR or some thing create a better cheat-system with tons of features to try to force gateway to have to improve their cheat-system functionality to stay competitive and relevant..

If I could choose just 1 code-type to be implemented, it would be #1 from my list above: The ability to read from an address and add the value to the data-register; however it would really need a subtraction equivalent also! Because, although we can use a convoluted way to subtract a hard-coded arbitrary number that we decide our selves (the cheat-code makers), in a code-type like #1 there is no way (not even a convoluted one) to subtract a number that was read from an address by only using addition.. It is literally impossible.. So if #1 were to be implemented, it would really need the subtraction counter-part too or else the code would be half-baked.. You could always add more stuff like rupees, hearts, etc, but there are lots of situations where you have to subtract too (enemies' health, player X and Y coordinates, etc)..

 

[FF777]

I'm very interested in knowing how you found this code.

I'm not sure what you did to try to make such a code as yours, but I will go through the steps of what I did on mine I guess..
First of all, I am not sure why you are setting large swaths of 32-bit values every where.. That might have some thing to do with the freezing at the end of a dungeon..

When I started searching for the heart code, I knew that zelda games usually sub-divide each heart in to smaller sub-units, because usually in zelda games it is possible to suffer half-heart damage and end up with, for example, 4.5 hearts..
Because of this presumption I didn't start with an exact-value search like "I have 5 hearts so I will search for the value '5'"......I didn't think that would lead me any where..
Instead I did the relative-value search, but the 8-bit version of it because I guessed that the game probably didn't sub-divide the hearts finely enough to push the total possible heart value over that of 255.. And of course I chose the "unsigned" version of the search because the game doesn't really deal in negative heart values (hopefully we can use the signed version when nintendo comes out with a zombie version of zelda)..

Then you just do the rinse-&-repeat cycle of:
1: Change your current hearts (take damage from an enemy, or pick up hearts etc)
2: Do the next code search (greater than, lesser than, etc)
3: Some times I will just walk around for a while with out changing my hearts and just do an "Equal" search to filter out any other unwanted values that might be changing..

Eventually I found out that the heart value is at 32CA6404 (although I am playing the jap version, so not sure if it is different for other versions of the game or not) and I found out that the game sub-divides each heart in to 4 pieces; So if you have 2 entire hearts in the game, the current-heart value will be "8".. And also, I don't have any of the DLC for the game either (although that shouldn't make a difference, but can't be sure)..

While you are in the "View hits" list, you can push A to go to the hexadecimal map of the game's memory.. While I was in there looking at the current-hearts value (32CA6404), I noticed that the value immediately adjacent to this (32CA6405) was the same value as the current-hearts value (I had full life at the time).. I speculated that this adjacent value might possibly be the value that stores the maximum hearts possible (and turns out I guessed correctly)..

As I stated in one of my previous posts (I think), if I just crudely made a code that constantly sets the address 32CA6404 to a certain value, I will some times lose the ability to have the sword-beam when wearing the sword-suit; this is because the game apparently only enables the sword-beam if your current hearts are exactly equal to your maximum hearts.. So if your current amount of hearts has a higher value than the maximum number of hearts that are supposed to be possible, you won't have sword-beam functionality.. That is why I created a code that reads from the maximum heart value and copies it to the current heart value.. Although for some reason it doesn't fill up the extra heart containers that you have while wearing the heart suits (for some reason I guess they put the heart-suit hearts in a different address some where).. But this doesn't matter any way because you obviously can't wear the sword-suit if you are wearing a heart-suit, right?.. So even if you had full hearts while wearing a heart-suit, you still don't have the sword-beam because you aren't wearing the sword-suit..

 

[urherenow]

@FF777 You described exactly what I did. Except I am using the USA version with the latest update. I am well aware of losing pieces of heart in Zelda games, so I searched for 32bit unsigned (If you find what you're looking for, it's much faster than comparing every 8 bits. In badge arcade, it only takes 2 searches to be able to view the hit list if you do a 32 bit search, but 3 or 4 on an 8bit search). I swear every address in my code changes on my system when I gain/lose hearts, and always the same exact values, relative to the number of hearts I have. I have 1 code for regular, and another for 4 hearts.

@Localhorst86 Nah... can't be just graphics. The boss I fought last night was this dude(s) throwing bombs at me in a rail cart thingy. I would have been dead many times over...

I guess I'll have to go through the painful process of trying again with 8bit searches to see what comes up differently. Different region games usually do have different offsets though.

 

[FF777]

so I searched for 32bit unsigned (If you find what you're looking for, it's much faster than comparing every 8 bits.

That is probably the reason you aren't finding the value.. Yeah 32-bit search will be faster, but if the value you are seeking is actually only 8-bit, then you run in to some problems with a 32-bit search..

When doing a 32-bit search, the system is reading 4 bytes at a time and then comparing that to your search to see if it matches or not.. The 8-bit value you are looking for is actually only 1 byte.. So the only way you would find it with a 32-bit search is if the 3 neighboring bytes next to the one you are looking for are all zeros, such as: 08 00 00 00 (small endian)..

However, if any of the 3 neighboring bytes are not 00, then the 32-bit value would appear much bigger than what you are searching for.. So for example, if the byte you are looking for, plus the 3 neighboring bytes look like this: 08 36 00 00, then you are not going to find the 8-bit value you are searching for.. (And this is the case in zelda, because the byte right next to the current-heart value is where the maximum-heart value is stored)..

An other problem with your code is that, even if you did some how find the correct value using a 32-bit search, you don't want to use the 32-bit-write code-type to write an 8-bit value, because it will over-write the 3 neighboring bytes next to it (probably to 00 00 00).. If you look at your code lines that you made, you will see that it is writing lots of zeros every where, maybe even including to the maximum number of hearts that you are supposed to have..
Instead of the 0XXXXXXX code-type (32-bit), you should use the 2XXXXXXX code-type (which only writes 8 bits)..

 

[urherenow]

Shouldn't be a problem because EVERYTHING I am writing happens to be the current state of those addresses when I start a level and have full hearts. If I have full hearts (same is true for the code I'm using for 4 hearts), and manually change any one of those addresses to something different using the hex editor, then exit... nothing will change. In fact, I can go back and look at the address again, and it will have been changed back to what it was in my code.

For 4 hearts, the values are:

D3000000 32000000
00C824F4 01001010
00D8D9E0 42600000
00D8DB34 40800000
00D8F854 00000004
00D8F92C 40800000
00D8F944 40800000
00D8F990 40800000
00D8FBB4 00000004

8 hearts:
01002420
42E00000
41000000
00000008
41000000
41000000
00000008

Perhaps you just happen to find the pointer, while I found actual code, to include verification, or something?

 

[FF777]

Shouldn't be a problem because EVERYTHING I am writing happens to be the current state of those addresses when I start a level and have full hearts.

Well, your game is freezing at some point though, right?..
Just because those values might all be like that most of the time when you start a level, it doesn't necessarily mean they all stay at those exact values at other points in time (like exiting the level or some thing)..

I don't know what purpose every individual value serves in this particular game, but I try to stick to the coding principle of "Change only what you need to."
None of us know the game as well as the programmers that created it, so if one goes around freezing various values in to place so that they can not possibly change, and they have no idea if/when the game uses them (I would imagine those values are there for some reason), then it might lead to glitches at some point in the game when the game tries to change those values..

Kind of like if some one used a bazooka to kill a fly, and then wonders "Why is part of my house gone?".. A fly-swatter will do the job fine, you don't need any thing bigger, and your house will still be intact after you swat him..

P.S.: The address I am changing in my code is not a pointer.. I would have to use the pointer code-type to do that (the BXXXXXXX code-type)..

 

[urherenow]

Well, AFAIK there is no way to lose hearts outside of a level, so I guess I need to see what happens to those addresses when I'm in the town... Exiting the level with the code active is the only thing that causes the freeze (but thankfully, the fact that I have completed the level and whatever item I got from the chest is saved when I force a reboot and go back to the game )

Really, I'm just going to do the 8bit search thing to try to get the offsets for your code on the USA version. It will be satisfying, but the fact I found 8 addresses that have a direct relation to what you did with a single address is still going to bug me until I figure out why

Edit: and wouldnt you know it? The address is the same on my US version. Dont know what I was thinking before...

 

[DarkFlare69]

Your tutorial is much more in depth than mine.

 

[cooroxd]

Hi,

I'm trying to get the acnl text to item gateway cheat code to work on acnl. Here's the link: http://www.fort42.com/gateshark/game485/

Whenever I press "R" after typing the item code, the game freezes. Any ideas why? I assume you enable all 3 parts of cheats same time? I'm using the latest gateway launcher on latest firmware and i'm using a USA .3dz rom.

Also, i've tried other cheats like the unlimited coconut fruit, it works.

 

[Localhorst86]

Hi,

I'm trying to get the acnl text to item gateway cheat code to work on acnl. Here's the link: http://www.fort42.com/gateshark/game485/

Whenever I press "R" after typing the item code, the game freezes. Any ideas why? I assume you enable all 3 parts of cheats same time? I'm using the latest gateway launcher on latest firmware and i'm using a USA .3dz rom.

Also, i've tried other cheats like the unlimited coconut fruit, it works.

Usually when a code freezes the system it is manipulating the wrong addresses. Double check your code, if it still freezes the system it's simply not compatible.

Gesendet von meinem Elephone P6000 mit Tapatalk

 

[BobNoton]

Your tutorial is very helpfull, thank you for it.

I was asking myself if there is another one to know how to search very specific values, not like clear number like lifepoints or money, like in this sample for MHX game, made by @ymyn who I tried to join with no succes, with my comments afters "//" :


[(SELECT+L)Player speed multiplier(SELECT+R)Speed x1 Ver1.2]
DD000000 00000204 // On L + Select, like Localhorst86 explain
D3000000 00000000
00C027B0 XXXXXXXX -> x1.5:3FC00000, x2:40000000, x2.5:40200000, x3:40400000 // clearly the new value, obvious
00C027B4 E51F000C // maybe specific body parts' speed, really don't know
00C027B8 E5860040 // Same
00C027BC ED960A10 // Same
00C027C0 E12FFF1E // Same
0030A4C8 EB23E0B9 // Same
00C027C4 E51F001C // Same
00C027C8 E5860040 // Same
00C027CC E3A00000 // Same
00C027D0 E12FFF1E // Same
002F7DB4 EB242A82 // Same
D0000000 00000000
DD000000 00000104 //on R + Select
00C027B0 3F800000 // put the player speed at the initial value, no idea how it have been found
D0000000 00000000

it's simply a "writting address on value when triggered" code, but how does he found adress ? that's not the only one whitch contains magic adresses on gameshark, specially on this game
---
[EDIT]
That's because his code is not on GW code but in ARM-ASM code, my bad
----
I think my question has already been asked but clearly here :
How the fuck did he found the player's speed adress ? 0x803F make 32 831, he can't had search this kind of value...

---
[EDIT]
3F8 is a float of 1.0 value
But i still don't know the method to found it
---

 

[Onepunchbruh]

Can someone explain whole of this thread in simple words. Do I have to read all of it?

 

[BobNoton]

There is only 2 pages, you can read it quickly x)
But the main post is the most important in fact
After there is some sample of codes which can be helpful

 

[Deleted member 350372]

Hello. I have this weird problem with one of my pointers found in Mario Kart 7. Whenever I activate the code outside of a race, my game crashes with a white screen when trying to load a course. It's supposed to enable you to have infinite mushrooms in Time Trials. Note that I have added conditionals and it still doesn't work.

If anyone can help me, it would be very much appreciated.

Here are the codes I am showing you:

Code Without Conditionals

6FFFE71C 00000000
BFFFE71C 00000000
B0000558 00000000
20000BA0 00000000
D2000000 00000000

Code With Conditionals

4FFFE71C 16000000
3FFFE71C 18000000
BFFFE71C 00000000
B0000558 00000000
20000BA0 00000000
D2000000 00000000

NOTE: the 20000BA0 00000000 line enables you to use an item an unlimited number of times, even though it says 0 uses of the item, it still gives you an infinite amount for some odd reason.